For distributed data center computer systems, disasters can be caused by the environment (e.g., floods, earthquakes, fires), and also a coincidence of events within the computer system itself (e.g., operator errors, simultaneous crash of critical components due to software faults). To deal with environment disasters, computer systems typically run in multiple geographically dispersed data centers, which consist of interconnected database servers with independent failure mode. Data centers are connected through possibly redundant wide-area network links, and typically operate in a primary-backup manner; i.e., if the primary data center suffers a disaster, the backup data center takes over. To enable the take over, the data in the backup data center is continuously kept up-to-date.
Existing approaches for providing continuity of service in the event of disaster failures in database client and server systems address either intra-data center replication (i.e., local-area replication) or inter-data center replication (i.e., wide-area replication), but typically not both. Moreover, it is not trivial to combine existing point solutions into a computer system that provides both capabilities.
For example, a local-area replication mechanism may replicate a data item x in two databases DB-1 and DB-2 that both run in the same data center. To combine this mechanism with a wide-area replication scheme, it is necessary to carefully orchestrate the propagation of updates to x to other backup data centers. For performance reasons, both should not propagate the same updates to x to the backup data center. On the other hand, each update should be propagated to x in a fault-tolerant manner such that an update should not be lost if either DB-1 or DB-2 goes down. Existing systems for disaster recovery typically propagate updates at the level of a transaction log. Examples of such systems include Remote Database Facility (RDF) from Compaq Computer Corporation and Symmetrix Remote Data Facility (SRDF) from EMC. These systems do not provide any means to orchestrate the propagation of updates from multiple logs.
The traditional way to provide local-area replication is through a parallel database system, such as Oracle Primary Server (OPS) or Extended Parallel Server (XPS). These systems run in clusters, where each cluster node contains an instance of the database. With a shared-disk approach, used by OPS, the instances access the same disk (each cluster node mounts the disk). With a shared-nothing approach, used by XPS, the instances access their own disk, but can mount each other's disk if an instance fails. In both cases, the disk sharing requires special hardware. Furthermore, each instance in a cluster of a parallel database has its own transaction log, and disaster recovery at the transaction log level is usually used for such systems.
It would be advantageous to use databases from different vendors to decrease the chance of data corruption because the database replicas will be implemented differently. This advantage would be similar to multi-version programming.
However, parallel databases are inherently homogeneous systems: it is not currently possible to build a highly available system by combining standard databases from different vendors. This has become increasingly important in order to support e-commerce applications that have to be continuously available, by reducing the impact of data centers disasters and database failures on the overall system downtime.
In the past, it has not been possible to build a system which: (a) ensures continuity of service in the event of data center disasters and database crashes, (b) provides strong and well-defined consistency guarantees, (c) allows commercial, off-the-shelf, databases from different vendors to be used together in the system, and (d) tolerates unreliable failure detector mechanisms within data centers.
A solution to these problems has been long sought but has long eluded those skilled in the art.